Crypto License in El Salvador 2026

BSP license — when it applies

A BSP license in El Salvador is generally the relevant route for Bitcoin-specific services. This usually includes business models centered on BTC payments, BTC exchange, BTC custody, BTC wallet administration, and Bitcoin-based transfer or remittance-like activity.

Typical BSP-triggering models include:

• Bitcoin payment processors for merchants;
• BTC custodial wallets;
• BTC OTC desks;
• Bitcoin transfer services;
• Bitcoin-focused remittance operators.

The important limitation is scope: BSP should not be treated as a universal crypto license for every token or platform model. Once the business expands into non-BTC assets, token issuance, or broader platform services, the analysis usually shifts toward DASP or a hybrid review.

DASP license — when it applies

A DASP license in El Salvador is generally the correct route where the business provides services in relation to digital assets beyond a narrow Bitcoin-only perimeter. Under the Digital Assets Issuance Law (LEAD), the focus is functional: exchange, custody, transfer, order handling, platform operation, placement, and issuance-related services.

In practical terms, DASP analysis is usually triggered by:

• multi-asset exchanges;
• custodial wallets for multiple tokens;
• digital asset transfer services;
• token issuance and placement support;
• investment-product or structured digital asset offerings;
• RWA tokenization platforms where token issuance and administration are part of the model.

A useful technical nuance is that regulators increasingly look at control points: who controls private keys, who receives client instructions, who executes transfers, who takes fees from regulated activity, and who can freeze or release assets. Those control points often determine whether a software platform is actually a regulated service provider.

When a business may need both licenses or deeper legal analysis

Some businesses do not fit neatly into one box. A platform offering BTC services plus altcoin exchange, or a custody business that also supports token issuance, may require a combined analysis across both regimes. The same is true for cross-border structures where the El Salvador entity handles one part of the stack and an affiliated foreign company handles another.

Common overlap scenarios include:

• BTC-first exchange expanding into multi-asset trading;
• custodial wallet with both Bitcoin and non-Bitcoin assets;
• issuer platform that also provides secondary-market support;
• remittance structure with BTC settlement and fiat conversion;
• group structures splitting front-end, custody, and treasury across entities.

This is where RUE usually starts with a regulatory perimeter memo before incorporation. It is cheaper to scope the model correctly at the start than to re-paper the application later.

Who needs a crypto license in El Salvador — and who may not

A business usually needs a license in El Salvador if it intermediates, exchanges, transfers, safeguards, administers, places, or issues digital assets as a service. The trigger is operational function, not branding. Calling yourself a “Web3 platform” or “technology provider” does not remove licensing risk if you control wallets, execute transfers, or receive client assets.

Models that commonly trigger licensing include:

• crypto exchanges and broker-like platforms;
• custodial wallet providers;
• digital asset transfer services;
• Bitcoin payment processors;
• OTC desks;
• token issuance and placement support businesses;
• RWA tokenization platforms with issuance/admin functions;
• investment-product structures linked to digital assets.

Not every blockchain business is licensable activity. Pure software development, non-custodial analytics, open-source tooling, or infrastructure services may fall outside the perimeter if the provider does not control client assets, does not intermediate transactions, and does not act as a regulated service provider in substance.

Examples of regulated business models

Regulated business models usually include at least one of these control features: custody of client assets, control over transfer execution, exchange matching, order reception/transmission, placement of issued tokens, or administration of a digital asset platform. If your revenues come from facilitating those functions, licensing analysis is almost certainly required.

Grey areas: non-custodial tools, software, analytics, DAO tooling

Grey-zone models should be assessed case by case. Examples include:

• non-custodial wallets with embedded swap routing;
• DeFi interfaces with admin keys or fee capture;
• DAO tooling where a central operator still controls onboarding or treasury;
• analytics platforms that also execute transactions or freeze wallets;
• NFT or token platforms that move from software to issuance/intermediation.

The best test is function over label. This approach is consistent not only with local practice but also with broader FATF thinking under Recommendation 15. If the platform can actually move value, control access, or intermediate counterparties, it may already be inside the perimeter.

Documents you need for the application

A complete application package for a crypto license in El Salvador usually includes three layers of documents: corporate documents, personal and ownership documents, and a compliance/operating pack. Most delays come not from the legal drafting itself, but from missing apostilles, inconsistent ownership charts, and weak explanations of how the business will actually operate.

A practical document list usually includes:

• certificate of incorporation / draft constitutional documents;
• shareholder and director registers;
• UBO declaration and group structure chart;
• passport copies and proof of address for control persons;
• powers of attorney where founders act remotely;
• tax registration documents;
• business plan and financial model;
• AML/CFT manual;
• business-wide risk assessment;
• KYC/CDD/EDD procedures;
• KYT and sanctions screening workflow;
• cybersecurity policy and incident response plan;
• safeguarding / custody procedures if applicable;
• complaints handling and client disclosure documents;
• outsourcing agreements or vendor descriptions;
• business continuity and winding-down plan.

Core corporate documents

Core corporate documents establish legal existence and control. If shareholders are foreign companies, expect to provide constitutional documents, certificates of good standing where relevant, director resolutions, and legalized extracts. Spanish translations often affect timing as much as regulator review itself. RUE regularly coordinates this stage with apostille and corporate document support.

Compliance pack and business plan

The compliance pack is where serious applications separate themselves from template-driven filings. A useful business plan should not just describe the product; it should show:

• onboarding flow from first contact to approval;
• risk-scoring methodology by client type and geography;
• transaction monitoring escalation path;
• wallet and custody architecture;
• outsourcing map and vendor oversight;
• financial assumptions for 3 years;
• consumer disclosures and complaint handling;
• shutdown/winding-down mechanics.

That last point matters. A regulator is more comfortable approving a business that has already thought through how to stop safely if something goes wrong.

Banking, EMIs and fiat rails: the practical bottleneck

Banking is often the hardest part of launching a licensed crypto business in El Salvador. In practice, the question is not whether a bank account is theoretically possible, but whether your model fits the risk appetite of the specific bank or EMI you approach.

Business models usually face different levels of banking friction:

• Lower friction: software-only analytics, compliance tooling, non-custodial infrastructure;
• Medium friction: tokenization platforms without retail fiat flows, B2B settlement tools, enterprise wallet orchestration;
• Higher friction: custodial wallets, exchanges, OTC desks, payment processors;
• Highest friction: retail remittance, broad fiat on/off-ramp, high-risk geographies, complex nested payment flows.

Banks and EMIs typically ask for:

• license or filing status;
• detailed AML/KYC/KYT controls;
• source of funds and treasury policy;
• expected monthly volumes and corridors;
• customer profile and prohibited industries/geographies;
• proof of sanctions screening and blockchain analytics;
• group structure and UBO transparency.

For many founders, the best route is a staged approach: first secure the legal perimeter and compliance pack, then approach banking with a clean onboarding file. RUE often combines this with crypto business bank account support and broader high-risk business bank account planning.

AML, KYC and Travel Rule obligations after licensing

After licensing, AML is an operating system, not a policy folder. A licensed BSP or DASP should be able to show how customers are onboarded, how risk is scored, how wallets are screened, how alerts are reviewed, and how suspicious activity is escalated internally before any external report is made.

A minimum post-license compliance stack usually includes:

• KYC onboarding with identity verification, liveness or equivalent fraud controls where relevant, and beneficial ownership checks for corporates;
• CDD/EDD based on risk level, geography, product, and transaction behavior;
• PEP, sanctions, and adverse media screening at onboarding and on an ongoing basis;
• KYT / blockchain analytics for wallet exposure, typology alerts, and source-of-funds review;
• case management for alert investigation and escalation;
• record retention and evidence preservation.

Minimum compliance stack for a licensed DASP/BSP

The strongest licensed operators build a layered control environment:

• risk scoring at onboarding;
• rules-based and behavioral transaction monitoring;
• manual compliance review for higher-risk cases;
• thresholds for EDD and source-of-funds requests;
• clear MLRO/compliance ownership;
• periodic policy refresh and staff training.

One technical nuance: transaction monitoring should not look only at value. Velocity, wallet clustering, mixer exposure, sanctions adjacency, rapid in/out behavior, and unusual chain hopping are often more informative than ticket size alone.

Travel Rule and transaction monitoring in practice

For exchange, custody, and transfer models, Travel Rule readiness is increasingly part of real-world compliance even where local implementation details evolve. In practice, this means the business should be able to identify originator and beneficiary information, determine when the rule is triggered, and exchange required data securely with counterpart VASPs where applicable.

Technology options usually include:

• blockchain analytics and wallet screening tools;
• Travel Rule messaging layers such as TRISA or OpenVASP-type interoperability solutions;
• internal case-management systems linking KYC, KYT, and sanctions decisions;
• rule-based restrictions for unhosted wallets or high-risk counterparties.

This is one area where a weak setup becomes visible very quickly to banks, counterparties, and institutional clients.